Skip to content

Commit 75e055c

Browse files
sayborassayboras
committed
gha: Update workflow for v1.32
1 parent 2a371f3 commit 75e055c

7 files changed

+642
-642
lines changed

‎.github/workflows/build-envoy-image-ci.yaml

+129-129
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: CI Build & Push
22
on:
33
pull_request_target:
4-
types: [opened, synchronize, reopened]
4+
types: [ opened, synchronize, reopened ]
55

66
permissions:
77
# To be able to access the repository with `actions/checkout`
@@ -19,131 +19,131 @@ jobs:
1919
name: Build and push multi-arch images
2020
runs-on: ubuntu-latest-64-cores-256gb
2121
steps:
22-
- name: Set up QEMU
23-
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
24-
with:
25-
image: tonistiigi/binfmt:qemu-v7.0.0-28
26-
27-
- name: Set up Docker Buildx
28-
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
29-
30-
- name: Cache Docker layers
31-
uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
32-
with:
33-
path: /tmp/buildx-cache
34-
key: docker-cache-${{ github.head_ref }}
35-
restore-keys: docker-cache-main
36-
37-
- name: Login to quay.io
38-
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
39-
with:
40-
registry: quay.io
41-
username: ${{ secrets.QUAY_ENVOY_USERNAME_DEV }}
42-
password: ${{ secrets.QUAY_ENVOY_PASSWORD_DEV }}
43-
44-
- name: Checkout PR
45-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
46-
with:
47-
ref: ${{ github.event.pull_request.head.sha }}
48-
persist-credentials: false
49-
50-
- name: Prep for build
51-
run: |
52-
echo "${{ github.event.pull_request.head.sha }}" >SOURCE_VERSION
53-
echo "ENVOY_MINOR_RELEASE=$(cat ENVOY_VERSION | sed 's/envoy-\([0-9]\+\.[0-9]\+\)\..*/v\1/')" >> $GITHUB_ENV
54-
echo "ENVOY_PATCH_RELEASE=$(cat ENVOY_VERSION | sed 's/^envoy-\([0-9]\+\.[0-9]\+\.[0-9]\+$\)/v\1/')" >> $GITHUB_ENV
55-
echo "BUILDER_DOCKER_HASH=$(git ls-tree --full-tree HEAD -- ./Dockerfile.builder | awk '{ print $3 }')" >> $GITHUB_ENV
56-
57-
- name: Checking if cilium-envoy-builder image exists
58-
id: cilium-builder-tag-in-repositories
59-
shell: bash
60-
run: |
61-
if docker buildx imagetools inspect quay.io/${{ github.repository_owner }}/cilium-envoy-builder-dev:${{ env.BUILDER_DOCKER_HASH }} &>/dev/null; then
62-
echo exists="true" >> $GITHUB_OUTPUT
63-
else
64-
echo exists="false" >> $GITHUB_OUTPUT
65-
fi
66-
67-
- name: PR Multi-arch build & push of Builder image (dev)
68-
uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
69-
if: steps.cilium-builder-tag-in-repositories.outputs.exists == 'false'
70-
id: docker_build_builder_ci
71-
with:
72-
provenance: false
73-
context: .
74-
file: ./Dockerfile.builder
75-
platforms: linux/amd64,linux/arm64
76-
push: true
77-
tags: quay.io/${{ github.repository_owner }}/cilium-envoy-builder-dev:${{ env.BUILDER_DOCKER_HASH }}
78-
79-
- name: CI Builder Image Digest
80-
if: steps.cilium-builder-tag-in-repositories.outputs.exists == 'false'
81-
shell: bash
82-
run: |
83-
echo "Digests:"
84-
echo "quay.io/${{ github.repository_owner }}/cilium-envoy-builder-dev:${{ env.BUILDER_DOCKER_HASH }}@${{ steps.docker_build_builder_ci.outputs.digest }}"
85-
86-
- name: PR Multi-arch build & push of cilium-envoy
87-
uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
88-
id: docker_build_ci
89-
with:
90-
provenance: false
91-
context: .
92-
file: ./Dockerfile
93-
platforms: linux/amd64,linux/arm64
94-
build-args: |
95-
BUILDER_BASE=quay.io/cilium/cilium-envoy-builder-dev:${{ env.BUILDER_DOCKER_HASH }}
96-
ARCHIVE_IMAGE=quay.io/${{ github.repository_owner }}/cilium-envoy-builder:main-archive-latest
97-
BAZEL_BUILD_OPTS=--remote_upload_local_results=false
98-
cache-from: type=local,src=/tmp/buildx-cache
99-
cache-to: type=local,dest=/tmp/buildx-cache,mode=max
100-
push: true
101-
tags: quay.io/${{ github.repository_owner }}/cilium-envoy-dev:${{ github.event.pull_request.head.sha }}
102-
103-
- name: Install Cosign
104-
uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
105-
106-
- name: Sign Container Image
107-
run: |
108-
cosign sign -y quay.io/${{ github.repository_owner }}/cilium-envoy-dev@${{ steps.docker_build_ci.outputs.digest }}
109-
110-
- name: Install Bom
111-
shell: bash
112-
env:
113-
# renovate: datasource=github-releases depName=kubernetes-sigs/bom
114-
BOM_VERSION: v0.6.0
115-
run: |
116-
curl -L https://github.com/kubernetes-sigs/bom/releases/download/${{ env.BOM_VERSION }}/bom-amd64-linux -o bom
117-
sudo mv ./bom /usr/local/bin/bom
118-
sudo chmod +x /usr/local/bin/bom
119-
120-
- name: Generate SBOM
121-
shell: bash
122-
# To-Do: generate SBOM from source after https://github.com/kubernetes-sigs/bom/issues/202 is fixed
123-
run: |
124-
bom generate -o sbom_cilium-envoy_${{ github.event.pull_request.head.sha }}.spdx --format=json --image=quay.io/${{ github.repository_owner }}/cilium-envoy-dev:${{ github.event.pull_request.head.sha }}
125-
126-
- name: Attach SBOM to container images
127-
run: |
128-
cosign attach sbom --sbom sbom_cilium-envoy_${{ github.event.pull_request.head.sha }}.spdx quay.io/${{ github.repository_owner }}/cilium-envoy-dev@${{ steps.docker_build_ci.outputs.digest }}
129-
130-
- name: Sign SBOM Image
131-
run: |
132-
docker_build_ci_digest="${{ steps.docker_build_ci.outputs.digest }}"
133-
image_name="quay.io/${{ github.repository_owner }}/cilium-envoy-dev:${docker_build_ci_digest/:/-}.sbom"
134-
docker_build_ci_sbom_digest="sha256:$(docker buildx imagetools inspect --raw ${image_name} | sha256sum | head -c 64)"
135-
cosign sign -y "quay.io/${{ github.repository_owner }}/cilium-envoy-dev@${docker_build_ci_sbom_digest}"
136-
137-
- name: Envoy binary version check
138-
shell: bash
139-
run: |
140-
envoy_version=$(docker run --rm quay.io/${{ github.repository_owner }}/cilium-envoy-dev:${{ github.event.pull_request.head.sha }} cilium-envoy --version)
141-
expected_version=$(echo ${{ env.ENVOY_PATCH_RELEASE }} | sed 's/^v//')
142-
echo ${envoy_version}
143-
[[ "${envoy_version}" == *"${{ github.event.pull_request.head.sha }}/$expected_version"* ]]
144-
145-
- name: CI Image Digest
146-
shell: bash
147-
run: |
148-
echo "Digests:"
149-
echo "quay.io/${{ github.repository_owner }}/cilium-envoy-dev:${{ github.event.pull_request.head.sha }}@${{ steps.docker_build_ci.outputs.digest }}"
22+
- name: Set up QEMU
23+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
24+
with:
25+
image: tonistiigi/binfmt:qemu-v7.0.0-28
26+
27+
- name: Set up Docker Buildx
28+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
29+
30+
- name: Cache Docker layers
31+
uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
32+
with:
33+
path: /tmp/buildx-cache
34+
key: docker-cache-${{ github.head_ref }}
35+
restore-keys: docker-cache-main
36+
37+
- name: Login to quay.io
38+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
39+
with:
40+
registry: quay.io
41+
username: ${{ secrets.QUAY_ENVOY_USERNAME_DEV }}
42+
password: ${{ secrets.QUAY_ENVOY_PASSWORD_DEV }}
43+
44+
- name: Checkout PR
45+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
46+
with:
47+
ref: ${{ github.event.pull_request.head.sha }}
48+
persist-credentials: false
49+
50+
- name: Prep for build
51+
run: |
52+
echo "${{ github.event.pull_request.head.sha }}" >SOURCE_VERSION
53+
echo "ENVOY_MINOR_RELEASE=$(cat ENVOY_VERSION | sed 's/envoy-\([0-9]\+\.[0-9]\+\)\..*/v\1/')" >> $GITHUB_ENV
54+
echo "ENVOY_PATCH_RELEASE=$(cat ENVOY_VERSION | sed 's/^envoy-\([0-9]\+\.[0-9]\+\.[0-9]\+$\)/v\1/')" >> $GITHUB_ENV
55+
echo "BUILDER_DOCKER_HASH=$(git ls-tree --full-tree HEAD -- ./Dockerfile.builder | awk '{ print $3 }')" >> $GITHUB_ENV
56+
57+
- name: Checking if cilium-envoy-builder image exists
58+
id: cilium-builder-tag-in-repositories
59+
shell: bash
60+
run: |
61+
if docker buildx imagetools inspect quay.io/${{ github.repository_owner }}/cilium-envoy-builder-dev:${{ env.BUILDER_DOCKER_HASH }} &>/dev/null; then
62+
echo exists="true" >> $GITHUB_OUTPUT
63+
else
64+
echo exists="false" >> $GITHUB_OUTPUT
65+
fi
66+
67+
- name: PR Multi-arch build & push of Builder image (dev)
68+
uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
69+
if: steps.cilium-builder-tag-in-repositories.outputs.exists == 'false'
70+
id: docker_build_builder_ci
71+
with:
72+
provenance: false
73+
context: .
74+
file: ./Dockerfile.builder
75+
platforms: linux/amd64,linux/arm64
76+
push: true
77+
tags: quay.io/${{ github.repository_owner }}/cilium-envoy-builder-dev:${{ env.BUILDER_DOCKER_HASH }}
78+
79+
- name: CI Builder Image Digest
80+
if: steps.cilium-builder-tag-in-repositories.outputs.exists == 'false'
81+
shell: bash
82+
run: |
83+
echo "Digests:"
84+
echo "quay.io/${{ github.repository_owner }}/cilium-envoy-builder-dev:${{ env.BUILDER_DOCKER_HASH }}@${{ steps.docker_build_builder_ci.outputs.digest }}"
85+
86+
- name: PR Multi-arch build & push of cilium-envoy
87+
uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
88+
id: docker_build_ci
89+
with:
90+
provenance: false
91+
context: .
92+
file: ./Dockerfile
93+
platforms: linux/amd64,linux/arm64
94+
build-args: |
95+
BUILDER_BASE=quay.io/cilium/cilium-envoy-builder-dev:${{ env.BUILDER_DOCKER_HASH }}
96+
ARCHIVE_IMAGE=quay.io/${{ github.repository_owner }}/cilium-envoy-builder:${{ github.base_ref }}-archive-latest
97+
BAZEL_BUILD_OPTS=--remote_upload_local_results=false
98+
cache-from: type=local,src=/tmp/buildx-cache
99+
cache-to: type=local,dest=/tmp/buildx-cache,mode=max
100+
push: true
101+
tags: quay.io/${{ github.repository_owner }}/cilium-envoy-dev:${{ github.event.pull_request.head.sha }}
102+
103+
- name: Install Cosign
104+
uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
105+
106+
- name: Sign Container Image
107+
run: |
108+
cosign sign -y quay.io/${{ github.repository_owner }}/cilium-envoy-dev@${{ steps.docker_build_ci.outputs.digest }}
109+
110+
- name: Install Bom
111+
shell: bash
112+
env:
113+
# renovate: datasource=github-releases depName=kubernetes-sigs/bom
114+
BOM_VERSION: v0.6.0
115+
run: |
116+
curl -L https://github.com/kubernetes-sigs/bom/releases/download/${{ env.BOM_VERSION }}/bom-amd64-linux -o bom
117+
sudo mv ./bom /usr/local/bin/bom
118+
sudo chmod +x /usr/local/bin/bom
119+
120+
- name: Generate SBOM
121+
shell: bash
122+
# To-Do: generate SBOM from source after https://github.com/kubernetes-sigs/bom/issues/202 is fixed
123+
run: |
124+
bom generate -o sbom_cilium-envoy_${{ github.event.pull_request.head.sha }}.spdx --format=json --image=quay.io/${{ github.repository_owner }}/cilium-envoy-dev:${{ github.event.pull_request.head.sha }}
125+
126+
- name: Attach SBOM to container images
127+
run: |
128+
cosign attach sbom --sbom sbom_cilium-envoy_${{ github.event.pull_request.head.sha }}.spdx quay.io/${{ github.repository_owner }}/cilium-envoy-dev@${{ steps.docker_build_ci.outputs.digest }}
129+
130+
- name: Sign SBOM Image
131+
run: |
132+
docker_build_ci_digest="${{ steps.docker_build_ci.outputs.digest }}"
133+
image_name="quay.io/${{ github.repository_owner }}/cilium-envoy-dev:${docker_build_ci_digest/:/-}.sbom"
134+
docker_build_ci_sbom_digest="sha256:$(docker buildx imagetools inspect --raw ${image_name} | sha256sum | head -c 64)"
135+
cosign sign -y "quay.io/${{ github.repository_owner }}/cilium-envoy-dev@${docker_build_ci_sbom_digest}"
136+
137+
- name: Envoy binary version check
138+
shell: bash
139+
run: |
140+
envoy_version=$(docker run --rm quay.io/${{ github.repository_owner }}/cilium-envoy-dev:${{ github.event.pull_request.head.sha }} cilium-envoy --version)
141+
expected_version=$(echo ${{ env.ENVOY_PATCH_RELEASE }} | sed 's/^v//')
142+
echo ${envoy_version}
143+
[[ "${envoy_version}" == *"${{ github.event.pull_request.head.sha }}/$expected_version"* ]]
144+
145+
- name: CI Image Digest
146+
shell: bash
147+
run: |
148+
echo "Digests:"
149+
echo "quay.io/${{ github.repository_owner }}/cilium-envoy-dev:${{ github.event.pull_request.head.sha }}@${{ steps.docker_build_ci.outputs.digest }}"

0 commit comments

Comments
 (0)